Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: strange traffic ?
From: Jack <fulldis () jackmccarthy com>
Date: Fri, 26 Mar 2004 13:04:33 -0800 (PST)

More details are definitely needed, but let me ask a very basic question...is
it safe to assume that you're running some sort of AV software?  You're not
infected with a Blaster varient, right?  


--- "Aditya, ALD [Aditya Lalit Deshmukh]"
<aditya.deshmukh () online gateway technolabs net> wrote:
Dear list,
i am seeing strange traffic ... first something connects to 139 on windows
workstation ... 2 packets causes the svchost to crash.
and then i start seeing traffic to port 4444 from the same ip.

what is this traffic i am seeing ? any new kind of malware trying to open of
port 4444 with the initial vector of infection on port 139 ?

the machine is fully patched and protected by firewall from outside world
with a sniffer logging all the data ie scr, dst ip and ports numbers ( this
is how i know the above info ) 

and nothing suspecipous is there on the machine also ... since the machine is
under heavy watch anything unsual would be caught immediatly.... 


Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]